An organization's Internet-facing server was successfully attacked because the server did not have the latest security patches. The risk associated with poor patch management had been documented in…

The risk owner is the individual or entity assigned responsibility for managing a specific risk, including accepting it. If a risk has been formally documented and accepted, the risk owner bears accountability for the consequences should that risk materialize, as they have either implicitly or explicitly agreed to the potential impact.

An IT risk manager facilitates the overall risk management process, but they are typically not the ultimate accountable party for specific accepted risks; that falls to the designated risk owner.

A Server administrator is responsible for the technical implementation and maintenance, including patching, but if the risk of poor patch management was accepted by a higher authority (the risk owner), the ultimate accountability for losses lies with the risk owner, not the implementer.

A Risk practitioner identifies, assesses, and reports on risks, but they do not typically own or accept risks; their role is advisory and facilitative within the risk management framework.